Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

User is not is authorized to perform: aws-marketplace:Subscribe on resource: * with an explicit deny in a service control policy

1

Hi,

i want to apply for accessing Bedrock Claude models but i get the error: • Claude 3.5 Sonnet - User: arn:aws:sts::<id2>:assumed-role/AWSReservedSSO_AWSAdministratorAccess_<id/email> is not authorized to perform: aws-marketplace:Subscribe on resource: * with an explicit deny in a service control policy • Claude 3 Sonnet - User: arn:aws:sts::<id2>:assumed-role/AWSReservedSSO_AWSAdministratorAccess_<id/email> is not authorized to perform: aws-marketplace:Subscribe on resource: * with an explicit deny in a service control policy • Claude 3 Haiku - User: arn:aws:sts::<id2>:assumed-role/AWSReservedSSO_AWSAdministratorAccess_<id/email> is not authorized to perform: aws-marketplace:Subscribe on resource: * with an explicit deny in a service control policy • Embed English - User: arn:aws:sts::<id2>:assumed-role/AWSReservedSSO_AWSAdministratorAccess_<id/email> is not authorized to perform: aws-marketplace:Subscribe on resource: * with an explicit deny in a service control policy • Embed Multilingual - User: arn:aws:sts::<id2>:assumed-role/AWSReservedSSO_AWSAdministratorAccess_<id/email> is not authorized to perform: aws-marketplace:Subscribe on resource: * with an explicit deny in a service control policy

I know that i dont have the access rights, but how can i get them? Is this something my AWS admin of my company has to do or is ist an aws thing?

Thanks in advanced Best Regards Christoph

Topics
Management & GovernanceMachine Learning & AISecurity, Identity, & ComplianceGenerative AI on AWS
Tags
Service Control PolicyAWS Command Line InterfaceIAM PoliciesSecurity, Identity, & ComplianceAmazon Bedrock
Language
English
asked 9 months ago946 views
1 Answer
1
Accepted Answer

Hello.

As stated in the error message, it looks like your SCP is explicitly set to deny "aws-marketplace:Subscribe".
If you are not the organization administrator for the AWS account, you will need to ask an organization administrator to modify the SCP.
Any changes to SCPs must be made in the AWS Organizations management account.
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html

EXPERT
answered 9 months ago
EXPERT
reviewed 8 months ago
EXPERT
reviewed 9 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content